Reviews Dockerfiles, .dockerignore and Compose files before you build and push: what ends up inside the image and who can read it, and what a container started from it can reach on its host. Catches secrets left in layers, build arguments and the environment, a build context copied whole, mutable base tags, downloads run unverified, containers running as root, the Docker socket, privileged mode, host namespaces and ports published on every interface, then gives the smallest Dockerfile and run-time edits that close each path and what to rotate if the image is already pushed.